Drupal 7 Module Development

Drupal Permissions and Security
Using AJAX in other contexts
While form handling of AJAX provides both a tidy API and a security check, we are
not so lucky when using other AJAX callbacks. To quote Greg Knaddison, member
of the Drupal security team and author of Cracking Drupal, the definitive work on
Drupal security:
[I]t is often tempting when building a rich AJAX feature to slip back into creating
a CSRF vulnerability via GET requests….However, because this practice of taking
action in response to GET requests is not as common or standard as the form
system, there is no way to provide this protection automatically or easily.
Cracking Drupal, pg 18.
To understand the point, let's look at a typical AJAX menu callback use case.
Suppose we want a module that allows users to add or delete items from a list via a
dynamic AJAX callback. The module might set up something like the following:
function example_menu() {
$items = array();
$items['example-ajax/%item/add'] = array(
'title' => 'Example AJAX add to list',
'page callback' => 'example_ajax_add',
'page arguments' => array(1),
'access arguments' => array('add to my list'),
'type' => MENU_CALLBACK,
);
return $items;
}
function example_ajax_add($item) {
// Do something.
}
Looking at the preceding code, several issues should be immediately apparent:
• The default access callback user_access() is probably insufficient, since we
are managing a per-user list
• The permission add to my list provides no means to check if the user is the
owner of the list being edited
• Simply trying to hide the menu item from the site navigation (through the
use of the MENU_CALLBACK property) will not prevent other users (or even
search engine crawlers) from eventually finding the page
[ 236 ]